diff --git a/lib/controller/checks.py b/lib/controller/checks.py index c86593260..bdc76cd45 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -497,11 +497,11 @@ def simpletonCheckSqlInjection(place, parameter, value): firstPage, _ = Request.queryPage(payload, place, content=True, raise404=False) if not (wasLastRequestDBMSError() or wasLastRequestHTTPError()): - if getComparePageRatio(kb.originalPage, firstPage) > CONSTANT_RATIO: + if getComparePageRatio(kb.originalPage, firstPage, filtered=True) > CONSTANT_RATIO: payload = "%s AND %d>%d" % (value, randInt, randInt+1) payload = agent.payload(place, parameter, value, payload) secondPage, _ = Request.queryPage(payload, place, content=True, raise404=False) - result = getComparePageRatio(firstPage, secondPage) <= CONSTANT_RATIO + result = getComparePageRatio(firstPage, secondPage, filtered=True) <= CONSTANT_RATIO infoMsg = "simpleton test shows that %s " % place infoMsg += "parameter '%s' might " % parameter diff --git a/lib/core/common.py b/lib/core/common.py index a1a5b13fc..dfda08e02 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -1954,9 +1954,17 @@ def unicodeToSafeHTMLValue(value): return retVal def getErrorParsedDBMSes(): + """ + Returns array with parsed DBMS + names till now + """ return kb.htmlFp def showHttpErrorCodes(): + """ + Shows all HTTP error codes + raised till now + """ if kb.httpErrorCodes: warnMsg = "HTTP error codes detected during testing:\n" warnMsg += ", ".join("%d (%s) - %d times" % (code, httplib.responses[code]\ @@ -1964,7 +1972,16 @@ def showHttpErrorCodes(): for code, count in kb.httpErrorCodes.items()) logger.warn(warnMsg) -def getComparePageRatio(firstPage, secondPage): +def getComparePageRatio(firstPage, secondPage, filtered=False): + """ + Returns comparison ratio between + two given pages + """ + if filtered: + firstPage = getFilteredPageContent(firstPage) + secondPage = getFilteredPageContent(secondPage) + conf.seqMatcher.set_seq1(firstPage) conf.seqMatcher.set_seq2(secondPage) + return conf.seqMatcher.quick_ratio()